linux.git/fs/xfs, branch master

xfs: replace ns_capable_noaudit

2026-08-21T07:09:54+00:00

Now that capable_noaudit() is available, we don't need to keep
using ns_capable_noaudit() and specifying the usernamespace every single
time.

Signed-off-by: Carlos Maiolino 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino

xfs: fix capability check in xfs

2026-08-21T07:09:54+00:00

An user reported a bug where he managed to evade group's quota
by changing a file's gid to a different group id the same user
belonged to, even though quotas were enforced on both gids and the
file's size was big enough to exceed the quota's hardlimit.

Commit eba0549bc7d1 replaced a capable() call by a
has_capability_noaudit() to prevent unnecessary selinux audit messages.
Turns out that both calls have slightly different semantics even though
their documentation seems similar. Where in a nutshell:

capable() - Tests the task's effective credentials
has_ns_capability_noaudit() - Tests the task's real credentials

This most of the time has no practical difference but in some cases like
changing attrs (specifically group id in this case) through a NFS client
this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively
bypassing quota accounting checks.

Using instead ns_capable_noaudit() should fix this issue and prevent
selinux audit messages.

This also fix the remaining calls to has_capability_noaudit()

Fixes: eba0549bc7d1 ("xfs: don't generate selinux audit messages for capability testing")
Cc: stable@vger.kernel.org # v5.18
Reported-by: Dr. Thomas Orgis 
Signed-off-by: Carlos Maiolino 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Serge Hallyn 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino

xfs: restore bi_bdev in xfs_zone_gc_write_chunk

2026-08-21T07:09:54+00:00

xfs_zone_gc_write_chunk relies on bi_bdev to still be valid, which is not
true when XFS is used on top of a stacked block device.  This can lead to
misdirected GC writes, writing of plain text when using dm-crypt, or
miscalculated I/O limits in xfs_zone_gc_split_write.

Fix this by reassigning bi_bdev.

Fixes: 080d01c41d44 ("xfs: implement zoned garbage collection")
Signed-off-by: Christoph Hellwig 
Reviewed-by: Damien Le Moal 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: split ioend handling into a separate source file

2026-08-21T07:09:54+00:00

The ioend handling used to be only for buffered writeback, but has been
extended to direct I/O and reads.  Split it into a new source file.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Hans Holmberg 
Reviewed-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

xfs: factor out a xfs_iomap_set_anon_write helper

2026-08-21T07:09:54+00:00

De-duplicate the iomap setup for zoned writes.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Hans Holmberg 
Reviewed-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

xfs: fix zoned write iomap flags assignments

2026-08-21T07:09:54+00:00

Don't overwrite IOMAP_F_DIRTY with IOMAP_F_ANON_WRITE, but ensure both
flags are set instead.

Note that in practice this is harmless as all zoned writes force a metadata
transaction anyway, but incorrectly assigned flags are still a landmine
that will cause problems at some point.

Fixes: 058dd70c65ab ("xfs: implement buffered writes to zoned RT devices")
Fixes: 2e2383405824 ("xfs: implement direct writes to zoned RT devices")
Cc: stable@vger.kernel.org # v6.15
Signed-off-by: Christoph Hellwig 
Reviewed-by: Andrey Albershteyn 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Hans Holmberg 
Reviewed-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

xfs: fix racy open zone caching

2026-08-21T07:09:54+00:00

When testing on very fast storage devices, I've observed writers using
io_uring creating many open zones with just a few kiB written to it,
which then don't get used.  I tracked this down to multiple io_uring
helper threads finding a full zone in i_private, and then going on to
select a one, with the final one winning the race and leaving it in
i_private.

Fix this by dropping full zones from i_private as soon we find them,
checking cached for a cached zoned when a single writes needs a new zone,
and by keeping an existing cached zone in xfs_set_cached_zone when it
still has space available, dropping the newly found/allocated one
instead.  This uses i_flags_lock as a low-level spinlock for short
hold times to avoid interactions with the ilock, which is used for
completions.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Hans Holmberg 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

xfs: handle NULL open_zone for merged ioends in xfs_ioend_put_open_zones

2026-08-21T07:09:54+00:00

In theory we could fail multiple ioends before an open zone was assigned
to them, and the iomap code could merge them.  Check for NULL not only
for the main ioend but also all merged ones on ->io_list to handle this
case.

Fixes: 058dd70c65ab ("xfs: implement buffered writes to zoned RT devices")
Signed-off-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Reviewed-by: Hans Holmberg 
Reviewed-by: Damien Le Moal 
Signed-off-by: Carlos Maiolino

xfs: use inode_init_always_gfp with __GFP_NOFAIL in xfs_inode_alloc

2026-08-21T07:09:54+00:00

Just like the inode allocation itself, allocation of the security data
inside of inode_init_always(_gfp) must not fail here as we can be inside
an already dirty transaction context.  Note that we do not have to pass
GFP_NOFS explicitly as we are already in a nofs context when in a
transaction, as seen by the call to alloc_inode_sb.

Also update the comment about this a bit to be more clear.

Fixes: bf904248a2ad ("[XFS] Combine the XFS and Linux inodes")
Signed-off-by: Christoph Hellwig 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Carlos Maiolino

xfs: remove kmem_to_page()

2026-08-21T07:09:54+00:00

kmem_to_page() has been unused since commit 5ced480d4886 ("xfs: simplify
building the bio in xlog_write_iclog"), so remove it. This also removes
the last instance of 'struct page' in fs/xfs/.

Signed-off-by: Tal Zussman 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Carlos Maiolino